What every product gets

POST /hooks/pipeline HTTP/1.1
Host: hooks.acme.com
X-Webhook-Attempt: 1
X-Webhook-Signature: t=1792833000,v1=2c067386fcd9006ece95389e2fde364074ad34388decdfc0a31f3edce14d0252

{
  "id": "evt_2",
  "type": "Deal.opened",
  "at": "2026-10-24T09:10:00Z",
  "seq": 2,
  "data": {
    "id": "deal_1",
    "title": "Pilot",
    "amount": "5000.00",
    "company": "company_1",
    "stage": "opened"
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto'

// verify(request, secret): true when the delivery was signed with your secret in the last 5 minutes
export async function verify(request: Request, secret: string) {
  const header = request.headers.get('X-Webhook-Signature') ?? ''
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false
  const want = createHmac('sha256', secret).update(`${t}.${await request.text()}`).digest()
  const got = Buffer.from(v1 ?? '', 'hex')
  return got.length === want.length && timingSafeEqual(got, want)
}

// The receiver: verify a copy, then read the Event once by its id.
const seen = new Set<string>()
export default {
  async fetch(req: Request) {
    if (!(await verify(req.clone(), process.env.PIPELINE_WEBHOOK_SECRET!))) return new Response(null, { status: 401 })
    const event = await req.json()
    if (!seen.has(event.id)) seen.add(event.id)  // a retry carries the same id
    return new Response(null, { status: 204 })
  },
}

{
  "tools": [
    {
      "name": "getCompany",
      "description": "Answers one company by its domain, with its headcount and sector.",
      "inputSchema": {
        "type": "object",
        "properties": { "domain": { "type": "string" } },
        "required": ["domain"]
      },
      "outputSchema": { … },
      "annotations": { "readOnlyHint": true },
      "_meta": { "price": 0.002, "currency": "USD" }
    },
    {
      "name": "searchCompanies",
      "description": "Lists the companies in one sector, each with its domain.",
      "inputSchema": {
        "type": "object",
        "properties": { "sector": { "type": "string" } },
        "required": ["sector"]
      },
      "outputSchema": { … },
      "annotations": { "readOnlyHint": true },
      "_meta": { "price": 0.005, "currency": "USD" }
    },
    { "name": "search" },
    { "name": "fetch" },
    { "name": "do" }
  ]
}

{
  "currency": "USD",
  "rates": [
    { "name": "Company.get",
      "price": 0.002, "unit": "call" },
    { "name": "Company.search",
      "price": 0.005, "unit": "call" },
    { "name": "Company.watch",
      "price": 0.1, "unit": "month" }
  ],
  "free": { "Company.get": 100 },
  "credits": [
    10,
    50,
    { "pay": 200,
      "get": 220 }
  ]
}

curl https://companyfacts.apis.dev/mcp \
  -H "Authorization: Bearer $COMPANYFACTS_KEY" \
  --json '{
  "jsonrpc": "2.0", "id": 1, "method": "tools/call",
  "params": { "name": "getCompany", "arguments": { "domain": "acme.com" },
    "_meta": { "maxCost": 0.001 } }
}'

HTTP/1.1 200 OK
X-Cost: price=0, currency="USD"
X-Request-Id: req_30d98961416616e608d0

{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "isError": true,
    "content": [ … ],
    "structuredContent": {
      "type": "https://companyfacts.apis.dev/docs/errors#over_max_cost",
      "title": "Payment Required",
      "status": 402,
      "detail": "Company.get costs 0.002; the call allows 0.001.",
      "code": "over_max_cost",
      "instance": "req_30d98961416616e608d0"
    },
    "_meta": {
      "cost": { "price": 0, "currency": "USD" },
      "requestId": "req_30d98961416616e608d0"
    }
  }
}